Opened 11 years ago

Closed 10 years ago

#348 closed design (fixed)

Realms and scope

Reported by: mnot@… Owned by: draft-ietf-httpbis-p7-auth@…
Priority: normal Milestone: 20
Component: p7-auth Severity: In WG Last Call
Keywords: Cc:


There's an implicit acknowledgement that one resource does not know about another (from p3):

A cache cannot assume that a representation with a Content-Location different from the URI used to retrieve it can be used to respond to later requests on that Content-Location URI.

However, the mechanism we use (and rely upon for performance) from p7 makes no concessions on that point. A server that operates separate fiefdoms by allocating different portions of path-space cannot prevent one vassal state from learning the secrets of any other that uses these authentication mechanisms we so love to hate.

For instance, if "/kind/and/naive" is authenticated in the realm "puppies", then "/kinda/shifty" can harvest their authentication information if a logged in user agent navigates there. See "log out" discussion for exacerbating stuff. User agents don't know (or care) for this distinction.

Of course, this is all pretty obvious, but is this worth acknowledging in Section 6?

Attachments (1)

348.diff (1.9 KB) - added by julian.reschke@… 11 years ago.
Proposed patch

Download all attachments as: .zip

Change History (7)

comment:1 Changed 11 years ago by julian.reschke@…

1) State it in sec cons

2) Note that new schemes should consider this

Changed 11 years ago by julian.reschke@…

Proposed patch

comment:2 Changed 11 years ago by mnot@…

Please incorporate and close.

comment:3 Changed 11 years ago by julian.reschke@…

From [1672]:

add security consideration wrt realms (see #348)

comment:4 Changed 11 years ago by julian.reschke@…

  • Milestone changed from unassigned to 20
  • Resolution set to incorporated
  • Status changed from new to closed

comment:5 Changed 10 years ago by mnot@…

  • Resolution incorporated deleted
  • Status changed from closed to reopened

comment:6 Changed 10 years ago by mnot@…

  • Resolution set to fixed
  • Status changed from reopened to closed
Note: See TracTickets for help on using tickets.